MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 66c3ffa85ebe1d52aed7606ce14c717cad54b26fe95b93d1f9c681d4640d0831. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RustyStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 34 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 66c3ffa85ebe1d52aed7606ce14c717cad54b26fe95b93d1f9c681d4640d0831
SHA3-384 hash: dc262307d6f79df5f250fb1847b7d9516a5a6309995e46d79623cefd8142487882db380dc95204c435121fb3ac0d5434
SHA1 hash: 8ae2e74535328658b30cfdf6485a9c94d14190d8
MD5 hash: c83e20e256e05cf671974bb51f6b1a72
humanhash: high-stream-steak-edward
File name:file
Download: download sample
Signature RustyStealer
Create hunting rule
File size:2'040'896 bytes
First seen:2025-09-17 04:07:48 UTC
Last seen:2025-09-17 04:15:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3263ac4f179f7e24186699b3245eba91 (1 x RustyStealer)
ssdeep 49152:3IuMdx6LKE3Jfx+vit62/vnnr9HLo6Oha:3jMP6LKE3JfxIi5k6Oha
TLSH T18995EFC72F27BEB9F18C9878A241933D5193AE2D17C38651609F3E8A573D69D18F031A
TrID 38.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.6% (.ICL) Windows Icons Library (generic) (2059/9)
15.4% (.EXE) OS/2 Executable (generic) (2029/13)
15.2% (.EXE) Generic Win/DOS Executable (2002/3)
15.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe RustyStealer signed

Code Signing Certificate

Organisation:AppPack
Issuer:AppPack
Algorithm:sha256WithRSAEncryption
Valid from:2025-09-10T15:17:38Z
Valid to:2026-09-10T15:37:38Z
Serial number: 1427f4636ef0c48d4478e487ef2fb719
Thumbprint Algorithm:SHA256
Thumbprint: bc46ec5309f320e491b7273668093c66e3b0600a4cb912d11aa07779933b1b4e
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
Bitsight
url: http://178.16.54.200/files/5988343637/iAJPxdU.exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
100
Origin country :
US US
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
random.exe
Verdict:
Malicious activity
Analysis date:
2025-09-17 02:54:25 UTC
Tags:
lumma stealer auto redline amadey unlocker-eject tool arch-exec botnet loader telegram auto-reg themida generic auto-startup coinminer miner stealc vidar gcleaner rdp
Link:
https://app.any.run/tasks/75c59445-013d-4720-81a0-6ad60921dccf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/27812/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68ca343ed49ea3f1e4b6bb4e
Tags:
injection emotet obfusc virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Сreating synchronization primitives
Connection attempt
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug masquerade obfuscated packed packed packer_detected signed
Link:
https://www.filescan.io/uploads/68ca343d0d1238ff0aad77a0/reports/25bc1c1b-4031-4bf7-9b36-1266f879c26d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/66c3ffa85ebe1d52aed7606ce14c717cad54b26fe95b93d1f9c681d4640d0831
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-09-17T00:32:00Z UTC
Last seen:
2025-09-17T00:32:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/66c3ffa85ebe1d52aed7606ce14c717cad54b26fe95b93d1f9c681d4640d0831/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/2e63b41b-db57-4eee-8f04-e0b41b15fff5
Score:
81%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/66c3ffa85ebe1d52aed7606ce14c717cad54b26fe95b93d1f9c681d4640d0831
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/c83e20e256e05cf671974bb51f6b1a72
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/66c3ffa85ebe1d52aed7606ce14c717cad54b26fe95b93d1f9c681d4640d0831/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-09-17 03:31:20 UTC
File Type:
PE+ (Exe)
Extracted files:
47
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=m3b77kc6xyovflwxmbwoctdrpswvjmtp5fnzhupzy2a5izanbayq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/250917-eqgrhssmv3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c5ed9c85-2d98-4282-9685-d6c40751de92
Unpacked files
SH256 hash:
66c3ffa85ebe1d52aed7606ce14c717cad54b26fe95b93d1f9c681d4640d0831
MD5 hash:
c83e20e256e05cf671974bb51f6b1a72
SHA1 hash:
8ae2e74535328658b30cfdf6485a9c94d14190d8
Link:
https://www.unpac.me/results/60c785f3-c5bf-4b5e-b9f0-9b2ab3750d3c/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/66c3ffa85ebe/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/66c3ffa85ebe1d52aed7606ce14c717cad54b26fe95b93d1f9c681d4640d0831

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
Author:ditekSHen
Description:Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:Macos_Infostealer_Wallets_8e469ea0
Create hunting rule
Author:Elastic Security
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RustyStealer

Executable exe 66c3ffa85ebe1d52aed7606ce14c717cad54b26fe95b93d1f9c681d4640d0831

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3625376/
Cape
Cape
https://www.capesandbox.com/analysis/27812/

Comments